destination df_sshd {
  file("/var/log/sshd.log");
  };
filter sshd {
  program(sshd);
  };
log {
  source(s_all);
  filter(sshd);
  destination(df_sshd);
  };